1. Who We Are
Stevie G's Popcorn is operated by GStrasse LLC, a Nevada limited liability company. We operate a fundraising platform that connects organizations with supporters through the sale of gourmet popcorn.
2. Information We Collect
We collect the following information when you use our app:
- Name and email address when you register
- Organization name and type for Team Leaders
- For a Team Member under 18: their first name, last initial and age, given by their parent or guardian - never an email address or password of their own - and the parent or guardian's name and email address
- Purchase history and order data processed through Shopify
- Fundraiser performance data
- If you turn on notifications: a code that identifies your phone to the notification services (a push token), and the kind of phone it is
- When an invite code is typed in and does not match a fundraiser, a short record that it happened: your account number if you are signed in, or, if you are not, a scrambled (pseudonymised) form of your internet (IP) address. We use it only to stop people guessing invite codes, and we delete it after 24 hours.
3. Children's Privacy
Information about children, and how long we keep it
A child never has an account with us. A parent or guardian creates the account, signs in with a code we email to their own address, and agrees to our Terms on the child's behalf. The child does not sign in, does not give us an email address, and does not give us a password.
What we collect about a child, and why:
- The child's first name and last initial: the parent or guardian types it, so the parent can tell their children apart in the app, and so a team leader can see who is on the team
- The child's age: given by the parent or guardian, to know that a parent or guardian must be the one consenting
- The parent or guardian's email address: their own address, to send the sign-in code and to reach the adult responsible for the account
- A record that consent was given: created automatically when the adult agrees, so we can show, later, that a parent or guardian agreed and when
We do not collect a child's email address, phone number, photograph, home address, school name, full last name, date of birth, or location. We do not let a child sign in. We do not show a child's name on any page a stranger can reach - a child's selling link and discount code do not contain their name.
How long we keep it - our retention schedule:
- The child's first name, last initial and age: kept 90 days after the fundraiser ends, then erased. The sales record stays, but it no longer names anyone
- The parent or guardian's email address: kept as long as they keep their account, erased when they delete their account
- The record that consent was given: kept the same 90 days, then the child's name is erased from it. The date, the version agreed to, and the fact that a parent or guardian agreed are kept as a record with nobody's name on it
- An email address a team leader invited, if that person never joined: kept 30 days after the fundraiser ends, then erased. It is also erased as soon as the person joins, because it is no longer needed
- Automatic error reports, if one happens to include a name: kept 90 days from when the report is created, then erased by our error-reporting provider on its own schedule. We cannot make this shorter - the period is fixed by that provider, not by us
We keep no personal information about a child longer than 90 days after the fundraiser ends - and no longer than 90 days from its creation for an automatic error report, which is the one kind of record whose clock we do not control. Nothing about a child is kept indefinitely. If a parent or guardian asks us to erase their child's information sooner, we do it - write to support@steviegspopcorn.com and we will erase it within 30 days, and usually the same week.
A parent or guardian can always: ask to see what we hold about their child, ask us to erase it, or withdraw consent and have the child stop taking part. Withdrawing consent means we erase the child's name and age; it does not undo sales that already happened.
Who else receives this information
We use other companies to run this app. Here is every one of them, and exactly what it receives about a child:
- Supabase: stores our database and sends the sign-in codes' account records. Receives the child's first name, last initial and age, and the parent or guardian's email address
- Sentry: tells us when the app crashes so we can fix it. Receives nothing by design. A crash report can sometimes include whatever was on screen, so it could include a child's first name. Sentry keeps crash reports for 90 days
- Resend: sends our emails. Receives the parent or guardian's email address. We do not put a child's name in an email sent outside the account
- Shopify: runs the store and takes the payment. Receives nothing about a child. An order is linked to a number, not a name
- Stripe: sends the money to the organization or, where the group has no EIN, to its Team Leader. Receives nothing about a child. Payouts go to an organization or its Team Leader, never to a child
- Expo: delivers notifications and over-the-air app updates. If you turn on notifications, it receives your phone's push token and the text of each notification, which never names a child. Apple and Google carry that notification to the phone. For updates it receives the app's version and the type of phone. It receives nothing about a child
- Cloudflare: checks that a person, not a robot, is signing up. It receives the phone's internet address and browser details. It receives nothing about a child
We do not sell a child's information, and we do not use it for advertising. We do not let any of these companies use it for their own purposes.
4. How We Use Your Information
We use your information to:
- Create and manage your account
- Process fundraiser enrollments and track sales
- Send transactional emails including invitations and welcome messages, and - for a Team Member under 18 - an email inviting their parent/guardian to create and manage that Team Member's account
- Send a buyer one thank-you email about their order, on behalf of the fundraiser it supported.
- Calculate and report organization earnings
- Improve our platform and services
5. How We Share Your Information
We do not sell your personal information.
With the organization running your fundraiser. When you join a fundraiser as a Team Member, the Team Leader who runs it can see your name, your email address, and your sales totals, so they can organize their team. Where a Team Member is under 18, the Team Leader can also see the parent or guardian's name and email address, because the parent or guardian is the person the Team Leader needs to contact about that child's participation. A Team Leader only ever sees the people on their own fundraiser.
Buyers are not shared with organizations. If you buy popcorn, your email address is not given to the school, team or group running the fundraiser. They see that an order was placed, its total, and which Team Member it belongs to - not who you are. If they need to reach you about an order, they contact us and we contact you.
With the services that run the platform. We share information only with:
- Shopify: to process purchases and manage your store
- Supabase: to securely store your account and fundraiser data
- Resend: to deliver transactional emails
- Sentry: to tell us when the app crashes so we can fix it. It receives the crash report, which can sometimes include a name that was on screen, and keeps it for 90 days
- Stripe: to pay organizations their earnings, or the Team Leader who receives them for a group with no EIN. It receives the Team Leader's email address, the organization's name, and each payout's amount and fundraiser name. The Team Leader gives Stripe their own identity and bank details directly
- Expo, with Apple and Google: to deliver the notifications you turn on and to update the app
- Cloudflare: to tell people from robots when you sign up or sign in
All third-party services are bound by their own privacy policies and data protection agreements.
6. Data Security
We use industry standard security measures to protect your information including encrypted data storage, secure authentication, and HTTPS connections. Payments are handled entirely by Shopify and we never store payment card information.
7. Data Retention
We retain your account information for as long as your account is active. You may request deletion of your account and associated data at any time by contacting us at privacy@steviegspopcorn.com. A parent or guardian may withdraw their child's participation at any time. We then erase the child's name and age, as section 3 describes; the sales record stays, but it no longer names anyone. Records of invite codes that did not match a fundraiser are deleted after 24 hours.
8. Your Rights
You have the right to:
- Access the personal information we hold about you
- Request correction of inaccurate information
- Request deletion of your account and data
- Withdraw consent at any time
To exercise these rights, contact us at privacy@steviegspopcorn.com
9. Contact Us
If you have questions about this Privacy Policy or our data practices, please contact us:
- Email: privacy@steviegspopcorn.com
- Company: GStrasse LLC
- State: Nevada, USA
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify users of significant changes by email or through the app. Continued use of the app after changes constitutes acceptance of the updated policy.
11. What the App Asks Your Phone For
The app asks for three permissions, each only when you reach the feature that needs it:
- Contacts: so you can pick people to text. We read your contacts on your phone and never copy, store or upload them
- Notifications: so we can tell you when someone buys through your link and when your fundraiser is about to end. You can say no and use everything else
- Photos: only to save your selling code as an image, and we do not read your photos
When you tell us how old you are, the app may also ask Apple or Google for your age range, to check your answer. That answer decides which screen you see next. It is not recorded or sent to us.